CVE-2026-64879
Command Injection
At a glance Severity CRITICAL 9.4 EPSS EPSS 2.26 % · percentile 83 (2026-10-27) State PUBLISHED Published 2026-07-21 Updated 2026-07-24 Assigner tenable NVD status Analyzed Description A filename supplied during file upload is not properly sanitized before being used in system command execution, allowing an attacker to inject shell metacharacters and achieve command injection via the audit file upload functionality.
Scores Version Score Vector Scored by CVSS 3.1 CRITICAL 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H tenable CVSS 4.0 CRITICAL 9.4 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H tenable CVSS 4.0 CRITICAL 9.4 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X NVD · vulnreport@tenable.com (Secondary) CVSS 3.1 CRITICAL 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H NVD · vulnreport@tenable.com (Secondary)
Weaknesses (CWE)
European references
CERT-FR advisories
Affected configurations (NVD CPE) cpe:2.3:a:tenable:security_center:*:*:*:*:*:*:*:* ≥ 6.6.0 ≤ 6.8.0Affected products
References
Sources
